Windows Token Privileges: A Field Checklist
Lab whoami /priv dump, OpenProcess notes on a process we own, integrity vs enabled privileges — no token-steal PoC.
Operating Systems
Container Escape Class Lessons (CVE-2022-0185-Era Themes)
Lab capsh –print and docker inspect seccomp/AppArmor, dropped caps, failed mount — no escape exploit.
PostgreSQL Privilege Boundaries and Extension Trust
Lab \du dump, a safe SECURITY DEFINER function, failed GRANT, search_path notes — no superuser exploit.
Why DES and RC4 Still Matter in AD Crypto Discussions
Lab klist encryption types, supported-etype table, GPO ‘Configure encryption types allowed for Kerberos’ — inventory, not cracking.
Kerberos Ticket Times and Checksums for Forensics
Lab klist dump, field-by-field decode of times and checksum types, clock-skew 401 — no ticket-forging steps.
Print Spooler LPE Class Lessons for Operators
Lab spooler service ACL and RPC interface dump, Point-and-Print registry, 7036/808 logs — no spool exploit.
NTLM Relay Defense Notes: Signing, EPA, and SMB/LDAP Controls
Lab registry/GPO signing dumps, Wireshark NTLM field names, failed-auth 4625 — no relay tool command line that fires.
sAMAccountName Impersonation Class (CVE-2021-42278 / CVE-2021-42287)
Lab event 4742/4768 samples redacted, computer-account naming checks, patch verification — no noPac exploit.